Need a Help on Role Hierarchy.Restricts Records based on User's Manager

Question

Role Hierarchy: User A is the Manager of User C and User B is the manager of User D. Now as per role hierarchy,Records created by User C & User D can be accessible to User A & User B.Although User A is not a manager of User D,he still can see the records owned by User D and Same for User B.

Our client is under impression that User A can see only those records owned by User C & User B can see only those records owned by User D.

Can someone please tell me if I want to restrict user A from viewing the records owned by User D and User B from viewing the records owned by User C.How can I restrict it?

Answer 1

According to your requirement, you do not want to share via role hierarchy. Because if that is shared then any user can see subordinate's data irrespective of Manager's name defined in the user.

Just to let you know, Manager's name in the User is not related to data visibility. This field is especially useful for creating hierarchical workflow rules and approval processes without creating more hierarchy fields.

Here sometimes criteria based sharing rule does not fit into your requirement. Because, it may possible you want show subordinate's all data to his manager only.

Approach will be

1. do not select Grant Access using Role Hierarchy for this object in Sharing Settings.

2. Creating User Managed Sharing Using Apex. Refer Sharing a Record Using Apex for more information.

After record is created, then call this method and pass the userOrGroupId taking value from your User's Manager field.

If you want that the manager will get All types of access then use Force.com managed sharing.

Otherwise access can be Edit, Read.

Below is the code snippet as to how data can be shared.

Apex code

public class JobSharing {

   public static boolean manualShareRead(Id recordId, Id userOrGroupId){
      // Create new sharing object for the custom object Job.
      Job__Share jobShr  = new Job__Share();

      // Set the ID of record being shared.
      jobShr.ParentId = recordId;

      // Set the ID of user or group being granted access.
      jobShr.UserOrGroupId = userOrGroupId;

      // Set the access level.
      jobShr.AccessLevel = 'Read';

      // Set rowCause to 'manual' for manual sharing.
      // This line can be omitted as 'manual' is the default value for sharing objects.
      jobShr.RowCause = Schema.Job__Share.RowCause.Manual;

      // Insert the sharing record and capture the save result. 
      // The false parameter allows for partial processing if multiple records passed 
      // into the operation.
      Database.SaveResult sr = Database.insert(jobShr,false);

      // Process the save results.
      if(sr.isSuccess()){
         // Indicates success
         return true;
      }
      else {
         // Get first save result error.
         Database.Error err = sr.getErrors()[0];

         // Check if the error is related to trival access level.
         // Access level must be more permissive than the object's default.
         // These sharing records are not required and thus an insert exception is acceptable. 
         if(err.getStatusCode() == StatusCode.FIELD_FILTER_VALIDATION_EXCEPTION  &&  
                  err.getMessage().contains('AccessLevel')){
            // Indicates success.
            return true;
         }
         else{
            // Indicates failure.
            return false;
         }
       }
   }

}

Answer 2

This is possible within PE, EE and UE editions of Salesforce.com through Org Wide Default Settings and record ownership. When you purchase Salesforce.com, the system is wide open, meaning that everyone can see and edit everything. When you want to restrict access to even one user, you need to lower permissions on that object for everyone. Org Wide Defaults are set under Setup/Security Controls/Sharing Settings. By lowering the Org Wide Default on an object to Private, then only the record Owner and Users above the Owner in the Role Hierarchy can see and edit that record. Sharing Rules, also under Setup/Security Controls/Sharing Settings can be used to handle exceptions and grant access across Roles in the Role Hierarchy (and to Public Groups of Users).

Best of luck!